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Abstract 

Most practical communication links are bi-directional. In these models, since the source node also 
receives signals, its encoder has the option of computing its output based on the signals it received in 
the past. On the other hand, from a practical point of view, it would also be desirable to identify 
the cases where such an encoder design may not improve communication rates. This question is 
particularly interesting for the case where the transmitted messages and the feedback signals are subject 
to eavesdropping. In this work, we investigate the question of how much impact the feedback has on 
the secrecy capacity by studying two fundamental models. First, we consider the Gaussian two-way 
wiretap channel and derive an outer bound for its secrecy capacity region. We show that the secrecy 
rate loss can be unbounded when feedback signals are not utilized except for a special case we identify, 
and thus conclude that utilizing feedback can be highly beneficial in general. Second, we consider a 
half-duplex Gaussian two-way relay channel where the relay node is also an eavesdropper, and find that 
the impact of feedback is less pronounced compared to the previous scenario. Specifically, the loss in 
secrecy rate, when ignoring the feedback, is quantified to be less than 0.5 bit per channel use when the 
relay power goes to infinity. This achievable rate region is obtained with simple time sharing along with 
cooperative jamming, which, with its simplicity and near optimum performance, is a viable alternative 
to an encoder that utilizes feedback signals. 
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I. Introduction 

Most communication links are bi-directional, where the backward channel can carry infor- 
mation and/or provides some form of feedback. For example, in ARQ schemes, the backward 
channel provides the acknowledgment of receipt of the packets. In peer-to-peer networks, infor- 
mation is communicated in both directions. The impact of the existence of bi-directionality on 
the channel capacity has been considered extensively up to date. Shannon proposed the two-way 
channel model in [1] where communication took place in both directions, and derived the inner 
bound and the outer bound on its capacity region. These bounds were shown to match for the 
full-duplex Gaussian two-way channel in [2]. An interesting implication of this result is that the 
signals received in the past, i.e., the feedback signals, is not needed for encoding to achieve the 
capacity region for this model. Though this feature is desirable in practice for simpler encoder 
design, it is also known that this approach is suboptimal in general, which was proved in [3] 
for a two-way channel where the two nodes share a common output from the channel. 

In secure communication, the question of whether feedback signals should be used for en- 
coding has been studied in several special scenarios. Shannon showed that a completely secure 
backward channel can be used to send a "one-time pad" to increase the secrecy capacity of the 
forward channel [4]. In [5], it was proved that such a strategy, where the source node decodes the 
key from the destination, is optimal for a degraded wiretap channel with a secure rate limited 
noiseless feedback link. Another achievable scheme, which does not require decoding of the 
feedback, was first proposed in [6] in the setting of secret key generation and later in [7]. 
The scheme proves even if the forward channel and backward channel each has zero secrecy 
capacity and hence sending key back is not possible, a positive secrecy rate can still be achieved 
when these two channels are used together. This is done by combining multiple channel uses 
and designing codes for the resulting equivalent broadcast channel in which the eavesdropper is 
eventually put at its disadvantage because of its lack of side information. Reference [8] combines 
this scheme with the key strategy in [4] and shows a higher secrecy rate is achievable for the 
model in [7]. 

In [5], [7], [8], the destination has the freedom to design the feedback signals. References [8], 
[9] also considered the scenario where the destination was restricted to sending its observation 
of the channel output, and hence could not manipulate the feedback signal to its advantage. It 
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was shown that feedback also helped to achieve a higher secrecy rate in this case. 

One feature that is common to the coding schemes in [5], [7], [8] is that the eavesdropper 
always receives two separate sets of received signals: one from the forward channel and a second 
set of signals from the backward channel if it is not secure. While this is more inline with the 
conventional information theoretic models with feedback [10, Section 7.12] [11], letting the 
eavesdropper receiving the signals of the forward and the backward channel separately might 
inadvertently give the eavesdropper an advantage, as compared to superimposing them together. 
Specifically, when the eavesdropper receives the sum of the outputs from the forward and the 
backward channel, introducing artificial noise into the backward channel at the time when the 
forward channel is in use can interfere the eavesdropper's observation of the forward channel and 
hence reduce its recognizance of the message being transmitted on it. This so-called "cooperative 
jamming" scheme has been shown to improve secrecy rates in a Gaussian two-way channel with 
an external eavesdropper [12]. Yet in reference [12], the source node does not take advantage of 
the signals it received from the backward channel when encoding its transmission signals. The 
question remains, therefore, in such a "cooperative jamming" scheme, whether the achievable 
rates can be improved by utilizing these signals. 

In this paper, we consider the wireless communication scenario where the eavesdropper 
observes the sum of the outputs of the forward and the backward channel, and hence the 
legitimate nodes in the network can potentially utilize both feedback signals and cooperative 
jamming to protect the confidential message. We focus on two models where both techniques 
are potentially useful: (i) a class of Gaussian full-duplex two-way wiretap channels, and (ii) a 
Gaussian half-duplex two-way relay channel with an untrusted relay. 

For the first model, we derive a computable outer bound to its secrecy capacity region. We 
then compare it to the achievable rates when the feedback is ignored at both nodes. Interestingly, 
when the ratio of the power constraint of the two legitimate nodes is fixed and the channel is 
fully connected with independent link noise, the gap between the achieved secrecy rate and the 
outer bound is bounded by a constant, which only depends on the channel gains. 

On the other hand, when the ratio of the power constraints is not fixed, we show that ignoring 
feedback signals leads to unbounded loss in the secrecy rate when the power increases. The loss 
is measured as the gap between the achievable rate when the feedback is used and the upper 
bound when the feedback is not used, hence is not caused by the potential sub-optimality of the 
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achievable scheme. This result shows that utilizing the feedback for encoding at the legitimate 
nodes is highly beneficial for this model in general. 

In the second model, we consider the case where the eavesdropper is part of the network rather 
than being external to it. In this model, two nodes wish to exchange information via a relay 
node from whom the information needs to be kept secret. Here the relay node is "honest but 
curious" [13], in that it will faithfully carry out designated relaying scheme, but is not trusted to 
decode the message it is relaying. This kind of setting was first considered in [14] for the three 
node relay channel and later thoroughly studied in [15] and [16]. Later, in [17], we considered 
a restricted version of the model in this work, by studying the case when the feedback signals 
were not used at the source or the destination for encoding purposes. In this paper, we identify 
one case where doing so will not incur much loss in secrecy rate. More specifically, we will 
prove if the power of the relay goes to oo, then the loss in the secrecy rates caused by ignoring 
the feedback is bounded by 0.5 bit per channel use. Interestingly, a simple TDMA scheme with 
cooperative jamming yields the achievable rate. 

The channel models in this work are closely related the the channel-type model in secret key 
generation literature; see [6], [18]— [21] for example. The major difference from these works is 
that our model accepts two inputs, one from the source, the other from the destination. The 
eavesdropper observes a noisy superposition of these two inputs. This is more complicated 
than the channel-type model where the noisy part of the channel is a wiretap channel which 
only accepts one input from the source node, and any input from the destination can only be 
transmitted over a noiseless public discussion link which is orthogonal to the wiretap channel. 
Recently, reference [22] has considered a channel-type secret key generation model where the 
channel component in the model accepts inputs from multiple nodes. Yet, these nodes only 
receive from the noiseless public discussion link [22, Section II], which is a fundamentally 
different model from those considered in this work. 

The rest part of the paper is organized as follows: In Section [TU. we describe the two models 
considered in this work. Section [III] focuses on the Gaussian two-way wiretap channel. Section 
llVl focuses on the two-way relay channel with an untrusted relay. Section |V] presents some 
alternative proofs to some results in previous sections. Section [VI] concludes the paper. 

Throughout the paper the notation C(x) is defined as C(x) = \ log 2 (l+x). Also Xi denotes the 
2th component of vector x, while x l denotes ...x^}. A/"(0, a 2 ) denotes a zero mean Gaussian 
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Fig. 1. Two-way wiretap channel 



distribution with variance a 2 . 

II. Channel Models 

In this section, we describe the two channel models considered in this work. Both models 
involve information exchange between two nodes: Node 1 and Node 2. Node 1 wants to send a 
message W\ to Node 2. Node 2 wants to send a message W 2 to Node 1. Both messages must 
be kept secret from the eavesdropper. The encoding functions used at the two nodes are allowed 
to be stochastic. Without loss of generality, we use Mj to model the local randomness in the 
encoding function used by Node j, j — 1, 2. 

A. The Two-Way Wiretap Channel 

The first model we consider in this work is a two-way wiretap channel model. The channel 
model is shown in Figure [Q The channel description is given by 

Pr(F, Y f , Z\X, X f ) = Pr(Z\X, X f ) Pr(Y|X, X f , Z) ^{Y f \Xj, X, Z) (1) 

From (OQ), we observe 

Y f -{X f ,X,Z}-Y (2) 

is a Markov chain. 

At each channel use, Node 1 and Node 2 transmit simultaneously. At the zth channel use, the 
encoding function of Node 1 is defined as: 

X i = f i {Y}- 1 ,W 1 ,M 1 ) (3) 
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The encoding function of Node 2 is defined as 

X u = g i {Y i - 1 ,W 2 ,M 2 ) (4) 

Note that with the introduction of Mj,j = 1,2, we can define fi,gi as deterministic encoders. 
Also note that another way to define /, is = /jpT 1-1 , YT~ l , Mi). It is easy to see that this 
definition is equivalent to the definition given in ©. 

Let n be the total number of channel uses. Node 2 must decode W\ reliably from Xf, Y n , M 2 , W 2 . 
Node 1 must decode W 2 reliably from Yj 1 , X n , Mi, W\. Let the decoding results be W\ and W 2 
respectively. Then we require 

lim Yi{W j + Wj) = 0, j — 1,2 (5) 

Hence, from Fano's inequality [10], we have 

HiW^X], Y n , M 2 , W 2 ) < ne 1 (6) 
H(W 2 \Y f n , X n , M x , W x ) < ne 2 (7) 

where Sj > and limn^oo Ej = 0, j = 1, 2. 

In addition, both messages must be kept secret from the eavesdropper. Hence 

I(W 1 ,W 2 ;Z n ) <ne 3 (8) 

where £3 > and Hindoo £3 = 0. 
Define Rj,j = 1,2 as: 

Rj = lim -H(Wj), j = 1,2 (9) 

The secrecy rate region is defined as all rate pairs {R\, R 2 } for which © and © holds. 

The Gaussian case of the two-way wiretap channel model was first proposed in [12] and is 
shown in Figure [21 Formally, the channel is described as: 

Yf = X f + N 3 + V^X (10) 
Y = X + Ni + yf(3X f (11) 
Z = Jh[x + Jh 2 X } + N 2 (12) 
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Fig. 2. The Gaussian Two-way Wiretap Channel 



where y/a, y/j3, \fh[ 1 y/h^ are channel gains. Ni, i = 1, 2, 3 are Gaussian random variables with 
zero mean and unit variance, representing the channel noise. We assume that given N 2 , Ni is 
independent from N 3 : 

p(N 1 ,N 2 ,N 3 )=p(N 2 )p(N 1 \N 2 )p(N 3 \N 2 ) (13) 

We use p to denote the correlation factor between Ni and N 2 . 77 denotes the correlation factor 
between N 2 and N 3 . Obviously, —1 < p < 1, and —1 < 7] < 1. 

From ([I]) and (fT3l) . we readily see this channel belongs to the class of channels described by 
(OQ) and shown in Figure [Q 

Observe that the terms y^aX and \/]3Xf are not shown in Figure [2l This is because each 
node knows its own transmitted signal and y/a, \/]3, \fh[, \fh-2, and can always subtract the 
interference caused by its own transmitted signals. Hence we can remove y/aX and \/j3Xf 
from (flOl) and (fTT)) . The channel is hence equivalent to 

Y f = X f + N 3 (14) 
Y = X + N 1 (15) 
Z = y/hX + v/hXf + N 2 (16) 

In the sequel we shall focus on this equivalent model instead. 

Let the power constraint of Node 1 be P. Let the power constraint of Node 2 be P r . 

1 n 

- 5> [Xl] < P (17) 
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Fig. 3. The Gaussian two-way half-duplex relay channel with an untrusted relay 



1 n 

-H E [ X lk]<Pr (18) 
u k=l 

Remark 1: When Yf is a constant, or, the feedback is ignored by Node 1, the model reduces 
to the relay channel with a confidential message to the relay, which was considered in references 
[16], [23], [24]. □ 

B. Two-Way Relay Channel with an Untrusted Relay 

The second model we consider in this work is the Gaussian two-way relay channel with an 
untrusted relay node. The channel model is shown in Figure [3] At any time slot, the channel 
either behaves as a MAC channel, shown on the left, or as a broadcast channel, shown on the 
right. After normalizing the channel gains, the MAC channel can be expressed as: 

Y r = X 1 + X 2 + N (19) 

The broadcast channel can be expressed as: 

Y 1 = VhX r + Ni (20) 

Y 2 = X r + N 2 (21) 

where \fh is the channel gain, h ^ 0. N, Ni, N 2 are independent zero mean Gaussian random 
variables with unit variance. 

We assume Node 1 and Node 2 transmit simultaneously during the MAC mode. Xj^j = 1,2 
denote the signals transmitted by Node j during the ith channel use such that the channel is 
in MAC mode, i > 1. We use fa to denote the number of channel uses that the channel was 
in the broadcast mode before this channel use. The notation X- denotes the set of signals: 
{X jtk , k = 
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Similarly X r ti denotes the signal transmitted by the relay node during the 2th channel use that 
the channel is in broadcast mode, i > 1. We use ipi t0 denote the number of channel uses that 
the channel was in the MAC mode before this channel use. 

^2,i, Yr,i are received signals defined in the same fashion. 

The channel switches between the MAC mode and the broadcast mode according to a globally 
known schedule. We assume the schedule is independent from the local randomness at each node, 
the messages and the channel noise. The first mode is assumed to be the MAC mode. The case 
where the first mode is a broadcast mode can be viewed as a special case of invoking the MAC 
mode first by transmitting nothing during the first MAC mode. The rate loss caused by the 
wasted channel use is negligible as the number of channel uses goes to oo. 

Suppose the MAC mode is activated for n channel uses. The broadcast mode is activated for 
m channel uses. Hence the communication spans over n + m channel uses. It should be noted 
that, in general, neither the n channel uses of the MAC mode, nor the m channel uses of the 
broadcast mode have to be consecutive. We assume the schedule is stable, in the sense that the 
following limit exists: 

a = lim (22) 

n+m^oo m + n 

For a given a, we use {T(a)} to denote a sequence of schedules with increasing total number 
of channel uses n + m such that (l22l) holds, and a is the limit of the time sharing factor of the 
MAC mode in the schedule T(a) as n + m — > oo. 

The average power constraints for the source, the jammer and the relay can be expressed as: 

1 n 

^—H E \ X U< P ii * = 1 '2, (23) 
fe=i 

i m 

—— E E [Kk] < Pr (24) 

For the purpose of completeness, we also introduce the notation P^i = 1,2 to denote the 
average power of Node i during the MAC mode. Since these two nodes are only transmitting 
during the MAC model, Pi and Pi are related as 

Pi = Pi/a, t = l,2 (25) 
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Similarly, we use P r to denote the average power of the relay node during the broadcast mode. 
Since the relay node only transmits during the broadcast mode, P r is related to P r as follows: 

P r = P r /(1 - a) (26) 

For the zth channel use in which the channel operates in the MAC mode, the encoding functions 
at Node 1, fi^, is defined as: 

X 14 = f 1 , i {Yt\W 1 ,M 1 ) (27) 
Similarly, the encoding functions at Node 2, f 2 .i, is defined as: 

X 2 , t = f 2 ,i(Y 2 *\W 2 ,M 2 ) (28) 

Note that fi ti , f 2>i are deterministic functions, and we use M r to model the local randomness at 
the relay. For the ith channel use in which the channel operates in broadcast mode, the encoding 
function of the relay node, g it is defined as: 

X rti = gi {Y^,M r ) (29) 

where Qi is a deterministic function. 

The eavesdropper knows Y™,X™, M r . Therefore, the secrecy constraint is expressed as 

lim H(Wx,W 2 \Y r n ,X!r,M r ) = lim ^—H(Wx,W 2 ) (30) 

m+n^oo m + U m+n-»oo 777 + U 

Since W — {X™ : Y™} — M r is a Markov chain, we have 

lim ^—H(W 1 ,W 2 \Y?,X?,M r )= lim —!—H(Wi, W 2 \Y r n , X r m ) (31) 

m+n^oo -)- 77, m+n^oo 777 -)- 77 

Therefore, the secrecy constraint can be expressed as 

lim —^—H(W 1 ,W 2 \Y r n ,X™)= lim —}—H{W u W 2 ) (32) 

m+n— >oo 777 -)_ 77 m+n— >oo 777 -j- 77 

Let Wj,j = 1,2 be the decoding result computed by the intended receiver of Wj,j = 1,2. 
Then the reliable communication requirement is expressed as 

lim PiiW, ^ Wj) = 0, j = 1, 2 (33) 

m+n— >oo 



Define i?i , i? 2 as 



R 3 = lim —|— #(^,.7 = 1,2 (34) 

m+n— >oo 77 -)- 777 



1 1 

The secrecy capacity region is defined as the union of all rate pairs (Ri, R 2 ) such that there is 
an a, a sequence of schedule {T(a)} and a choice of encoding function for which (1321) and (1331) 
are satisfied. 

Remark 2: In general, 

li m H (W\X™, YJ 1 ) ^ lim H (W\Y?) (35) 

n+m-+oo n + m n+m^oo n -\- m 

This can be proved by a counterexample: Consider the communication protocol: 

1) First the relay node randomly generates and broadcasts a key via X r to Node 1 and Node 
2 using a channel code. 

2) Node 1 uses the key as a one-time pad [4] to encrypt its confidential message W and 
sends it to the relay using a channel code. The other nodes remain silent. 

3) The relay decodes the codeword sent by Node 1 and encodes and forwards it to the 
destination. 

4) The destination recovers the codeword sent by Node 1 by decoding the signals from the 
relay. It then decrypts it with the key it received in step Q] and recovers W . 

Since the one-time pad is a perfectly secure cipher [4], for this communication protocol, we 
have: 

H (W) = H (W\Y r n ) (36) 

However, since the key is determined by X™, given the key, W is uniquely determined by Y T n . 
Therefore, we have 

H {W\X™, Y r n ) = ^ H{W\Y r n ) (37) 

□ 

III. Feedback in the Two-way Wiretap Channel 

A. Improvement on the Known Achievable Secrecy Rate: A Motivating Example 

For the two-way wiretap channel, reference [12] derived an achievable rate using Gaussian 
codebooks. However, in this scheme, the signal Yf received by Node 1 is not used to compute 
the signal X transmitted by Node 1. Likewise, the signal Y received by Node 2 is not used to 
compute the signal Xf transmitted by Node 2. We next show that this scheme can be improved 
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upon with respect to the achievable secrecy rate. To show this, it is sufficient to show that a 
larger Ri is achievable for Node 1 for a set of channel gains. In the following, we provide such 
an example. 

We assume p = 0, r] = 0, which means Ni, N 2 , N 3 are all independent, which was the setting 
considered by [12]. The largest rate for Node 1 achievable with the scheme of [12] is given by: 

fl - [C(F) - C fctTl)l + 08) 
which is achieved by letting Node 2 transmit an i.i.d. Gaussian sequence with variance P r . 
When /t2 p 1 +1 > 1, we observe from (1381) that the secrecy rate is always 0. Below, we choose 
P = 3, P r = 1, \fh[ = \/2, V^2 = 1 such that this condition is fulfilled and prove a positive 
secrecy rate is achievable with our scheme. 

The coding scheme we use is similar to that of [6]. It is composed of one channel use described 
in Figure HI followed by one channel use described in Figure \5\ In an odd step, Node 1 sends a 
signal denoted by J x and Node 2 sends a signal denoted by X 2 . After this step, Node 1 adds its 
received signal X 2 + N 3 to a new signal X\ and transmits it in the following even step. At the 
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Fig. 6. The Equivalent Channel 



same time, Node 2 sends a signal denoted by J 2 . We use the notation N{ to denote the channel 
noise in the odd step and N- to denote the channel noise in the even step. 

Combining these two steps, we obtain an equivalent memoryless channel shown in Figure [6] 
The achievable secrecy rate for this channel is given by [25]: 

[I (X 1 ;Y) - I (X 1 ;Y e , u Y e , 2 )} + (39) 

where 

Y = X 1 + N 3 + N[ (40) 

n ; i = X 2 + v^Ji + N 2 (41) 

F e , 2 = V2(X, + X 2 + N 3 ) + J 2 + N' 2 (42) 

We then choose Xi,X 2 ,J 1 , J 2 as zero mean independent Gaussian random variables with unit 
variance. From Figures @] and [5l this choice satisfies the average power constraints. Evaluating 
( l39l for this distribution, we get 



.2 



where a = \fl. 

Since the original channel takes twice as many channel uses to implement this scheme, the 
actual secrecy rate is half the value indicated by (1431) . However, this still means a positive secrecy 
rate is achievable. 

This means that utilizing feedback signals leads to higher achievable secrecy rate for this 
channel. 
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B. Outer Bound 

Although we have shown that using feedback can improve the secrecy rate, it remains unclear 
whether this can only be done by letting Node 1 use the signal Y to compute X. If the signal Y 
is not available to Node 1, is it possible to achieve the same rate via a smarter way to compute 
X r at Node 2? Additionally, if ignoring Y at Node 1 is suboptimal, is it possible to bound the 
consequent rate loss? To answer these questions, clearly, we need an outer bound on the secrecy 
capacity region of this model. 

We begin by deriving a bound on R x . 

Theorem 1: For the channel model in Figured! Ri is upper bounded by 



Remark 3: Ignoring Yf at Node 1 is equivalent to viewing Yf as a constant. From (|44l) . R u 
in this case, is upper bounded by 

max min{/(X; Y), I(X; Y\Z, X f ) + I(X f] Z\X)} (45) 

which is the upper bound proved in [24]. □ 

Theorem 2: The secrecy capacity region of the channel model in Figure CD is bounded by 




ax min{/(X; Y), I(X; Y\Z, X f ) + I(X f] Y f , Z\X)} 



(44) 



Proof: See Appendix lAl 



U 



Pr 



{(r u r 2 ) -.mmm holds} 



(46) 



< Rx < I (X; Y) 



(47) 



< R 2 <I(X f ;Y f ) 



(48) 



Ri + R2 < min 



I{X;Y\Z,X f ) + I(X f ;Z,Y f \X) 
I(X f ;Y f \Z,X) + I(X;Z,Y\X f ) 



(49) 



Proof: The proof is provided in Appendix [Bj ■ 
For a deterministic binary wire-tap channel, Theorem [2] leads to the equivocation capacity region, 
as shown by the following theorem: 
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Theorem 3: When X, X f are binary and V = X © X f , Y f = X f © X, Z = X © X /; the 
secrecy capacity region is given by 

Rj> 0,3 = 1,2 (50) 

7?! + ^ 2 <l (51) 

Proof: The achievability follows from [26, Theorem 2]. The converse follows from Theorem 
[2l The sum rate bound specializes as follows: 

I(X;Y\Z,X f ) + I(XfY f ,Z\X) (52) 

=/ {X- X\X® Xf, X f ) + / (Xf X f , X © Xf\X) (53) 

=/ (X; X\X, X f ) + I {Xf, Xf, X\X) (54) 

=I(XfX f ,X\X) (55) 

<if (X/) < 1 (56) 

■ 

We next consider the Gaussian channel. 

Theorem 4: When Yf is a constant, i.e., Yf is ignored by Node 1, the secrecy rate R\ is upper 
bounded by 

P(l + a 2 - Vhp) 2 \ / h 2 P r 



Mo c \ a+J-sHhiP+i+o*) ) +c [tt^) (57) 



Proof: Define iV 4 as a Gaussian random variable such that N4 ~ A/"(0, a 2 ) and is independent 
from Ni, i = 1,2, 3. Recall that Z is the signal received by the eavesdropper. We next consider 
a channel where the eavesdropper receives Z + N 4 . Since Z + N 4 is a degraded version of Z, 
we can find an upper bound of the original channel by deriving an upper bound for this new 
channel. This upper bound is found by applying the bound (1451) . 

We next prove that all terms in the upper bound (l45l) is maximized when X, Xf are independent 
and each has a Gaussian distribution with zero mean and maximum possible variance: I(X; Y) 
is obviously maximized by this distribution. For the other two terms, we have: 

I(X;Y\X f ,Z) (58) 
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=/ \X; X + Ni\X f , sfhxX + Jh 2 X f + N 2 + N A j 

=h (x + N x \X f , y/hX + y/faXf + N 2 + N^-h (iVi|iV 2 + A/4) 

<h (x + Ni\<Jh x X + N 2 + N A \-h (iVi|iV 2 + N 4 ) 



(59) 



(61) 



(60) 



and 



I(X f ;Z\X) 



(62) 



=/ [Xf, Jh 2 X f + N 2 + N 4 \Xj 

=h {\fh 2 X f + N 2 + N 4 \X^j -h(N 2 + N 4 ) 

<h (\[h 2 X s + N 2 + N A \ - h (N 2 + N4) 



(63) 



(64) 



(65) 



Equations (loTI) and (1651) show that the second term in (l45l) is maximized when X and X/ are 
independent. Moreover, (loTI) is known to be maximized when X has a Gaussian distribution 
with the maximum possible variance; see [27]. (1651) is also maximized when has a Gaussian 
distribution with the maximum possible variance. Hence we have shown the optimal input 
distribution for X, Xf is an independent Gaussian distribution. For this distribution, it can be 
verified the second term in (|45T) becomes (1571) . 

Hence we have proved the theorem. ■ 
Remark 4: When cr 2 — > 00, (1571) converges to C(P), which corresponds to the first term in 
(1451) . Thus, (1571) is written as one term instead of the two terms as in (1451) . □ 

Remark 5: We introduce iV 4 to further tighten the bound. For example, consider the case 
where p = 77 = 0. In this case the upper bound can be expressed as 



where a = 1/(1 + a 2 ). Consider choosing the remaining parameters as hi = l,h 2 = 10, 
P = 100, P r = 5. It can be verified that the minimum is attained around a = 0.09, and not at 
cr 2 = 0. Hence, the bound presented here is tighter than the bound in [24]. □ 
Next, we present the following theorem. 

Theorem 5: The secrecy capacity region of the Gaussian two-way wiretap channel is outer 




(66) 
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bounded by 

< Ri < C(P) (67) 
< R 2 < C(P r ) (68) 

/ P r (h 2 +l+a 2 -2Vh^ri) \ 
° ^ 1+^V ) 



p(i+u 2 -VThp) 2 
2 >0° I 7TT^—^Wh7pTTT^ 



inf rT 2 >n C 



Ri + R 2 < min < 



(l +(T 2„ p 2)( /ll p +1+CT 2 ) 
mi cr 2>o G I Fi , _2 — Z5T7T" n , i , I + G 



(l +(7 2_ r) 2)( fe2 p r , + 1+CT 2) I ' \ l+a^-p 



(69) 



Proof: Again we consider a channel where the eavesdropper receives Z + N 4 and derive 
an outer bound for this new channel. YV4 is as defined in the proof of Theorem HI 

To prove the theorem, we first show I(X;Y), I(X;Y\Z,X f ), I(X f ; Y f , Z\X), I(X f ;Y f ), 
I(Xf;Yf\Z, Xf) and I(X;Z, Y\Xf) are maximized simultaneously when X and Xf are inde- 
pendent, X ~ W(0, P), and X f ~ W(0, P r ). 

Due to the symmetry of the channel model, we only need to show I(X; Y), I(X; Y\Z,Xf) 
and I(Xj; Yf, Z\X) are maximized by this distribution. 

The case of I(X; Y\Z,Xf) was shown in the proof of Theorem HI 

For I(X f ;Y f ,Z\X),we have: 

I(X f ;Y f ,Z\X) (70) 
=/ (x f - X f + iV 3 , Jh 2 X f + N 2 + N 4 \X] (71) 



=h \Jh2Xf + N 2 + N 4 , X f + N 3 \Xj -h(N 2 + iV 4 , N 3 ) (72) 
<h (Jh 2 Xf + N 2 + N 4 , X f + N 3 )-h (N 2 + 7V4, N 3 ) (73) 



Hence I(X f]Yf, Z\X) is maximized when X and Xf are independent, X ~ fi/(0,P), and 
~ jV(0, P r ). The theorem then is a consequence of Theorem [2] when evaluated at this input 
distribution. ■ 

Remark 6: The introduction of N4 is again useful in tightening the bound. For example, 
consider the case where p = r\ — 0, hi = 1, h 2 = 10, P = 100, P r = 5. 

In this case the upper bound on Pi, which is C(P), is about 3.3291. The first term inside the 
minimum in (l69l) , which is also an upper bound on Ri takes the form: 

min C f 7 ) + C ( p r (ah 2 + 1)) (74) 



o<«<i Va/iiP + 1 
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where a = 1/(1 + cr 2 ). It can be verified that the minimum is smaller than 3.24 and is attained 
around a = 0.32. Hence the upper bound on i? x is dominated by the first term inside the 
minimum in (|69l) and is not attained at a 2 = 0. □ 

C Achievable Rates for the Gaussian Two-way Wiretap Channel 

Let us use [x] + to denote max{x, 0}. Then we have the following theorem. 
Theorem 6: Define R* as 

i?t = max a 

0<a<l 

and i?2 as 

RX = max a 

0<a<l 

Define the region R as the convex hull of the following three rate pairs of (R±, R 2 ): 

(0,0), (R{,0), (0,R* 2 ) (77) 

The rate region R is achievable. 

Proof: The proof is given in Appendix O ■ 

Remark 7: The achievable scheme is composed of two phases. During phase one, with a time 
sharing factor of 1 — a, Node 2 sends a key to Node 1. During phase two, Node 1 utilizes this 
key to encrypt its message and transmits the result to Node 2. Hence when a = 1, R is achieved 
when both nodes ignore their received signals when computing their transmitting signals. □ 

Remark 8: The achievable secrecy rate derived here may be potentially improved further by 
combining it with the scheme in Section IIII-AI However, as we shall see later, Theorem [6] is 
sufficient to bound the rate loss when the feedback signals are not used by the legitimate nodes. 
□ 

D. Comparing the achievable rates and the outer bound 

We first consider the case with independent link noise, which is the model considered in [12]. 
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1) p = V = 0; 

Theorem 7: When p = 77 = 0, P r = kP, k is a positive constant, and hj ^ 0,j = 1,2, the 
loss in secrecy rates when received signals are not used to compute transmitting signals at Node 
j, j = 1, 2 is bounded by a constant, which is only a function of hi and h 2 . 

Proof: The proof is given in Appendix [Ql ■ 

Theorem 8: Even in the case where cooperative jamming is possible (hj ^ 0, j — 1, 2), when 
P is not proportionally increasing with P r , ignoring Yf at Node 1 can lead to unbounded loss 
in the secrecy rate. 

Proof: The proof is given in Appendix [0 ■ 
We next consider a special case of the model that attracted some interest in the past [24], 
[28]. In this model, Z is a degraded version of Y given Xf, and Yf is ignored by Node 1: 

2) hi < l,p — \fh~i and Yf is a constant: In this case, N 2 can be written as ^ s /h~[Nl + N' 2 , 
where N' 2 is independent from N x , N 3 and N' 2 ~ A/"(0, 1 — hi). Then the signals received by the 
eavesdropper Z can be expressed as: 

Z = Jh~iX + /h 2 X f + ^Jh~iNi + N' 2 (78) 

= ^Jhi (X + Ni) + N' 2 + Jh 2 X f (79) 

From this, we observe that, given Xf, Z is a degraded version of Y = X + Ni. 

Corollary 1: When hi < 1, p = y/h~i, and h 2 ^ 0, Yf is a constant, then the achievable rate 
of Ri using cooperative jamming is at most 0.5 bit per channel use from the secrecy capacity. 

Remark 9: Corollary \T\ was first proposed in [28] and later appeared in [24]. Here we first 
describe the approach of [24]: 

From Theorem [6] and Remark |7J the achievable rate for Ri in this case is obtained by letting 
a = 1 and evaluating R\. In this case 

Ri = C(P) - C{-^—) (80) 
h 2 P r + 1 

The upper bound proposed in [24] on Ri is 

min{C(P), C(P) - C(hiP) + C(h 2 P r )} (81) 

Here we observe (f8~TI) can be obtained from (1571) when evaluated with a 2 — > oo and a 2 = 0. 
Reference [24] proves Corollary \T\ by comparing (l80l) and (I8TI) . It can be then verified that the 
gap between (l80l) and (I8TI) is less than 0.5 bit per channel use. 
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Fig. 7. Two-way wiretap Channel with Additional Public Noiseless Forward Link 

The approach of reference [28] is different and uses results on a wiretap channel with noisy 
feedback. This proof is delegated to Section |V] 

IV. Feedback in Half-Duplex Two-way Relay Channel with An Untrusted 

Relay 

In this section, we derive the outer bound for the secrecy capacity region of the two-way relay 
channel with an untrusted relay in Section III-BI (Figure [3]). To find the outer bound, we first 
consider the channel in Figure [7J 

We assume X\ and X 2 have the same power constraint as the Xi, X 2 in Figure |3] M r is now 
accessible to Node 1 and delivered to the other nodes via a public noiseless link. The remaining 
part of the channel is activated when the original two-way relay channel is in the MAC mode, 
and is inactive when the original two-way relay channel model is in the broadcast mode. Doing 
so ensures the overall number of channel uses to be the same between these two models. 

Recall that Mj,j = 1,2 still models the local randomness at Node j,j = 1,2. The encoding 
function of Node 1 at the ith channel use when the channel is active can be defined as: 

X hi = h,i{Yt\ Wi, Mi, M r ) (82) 

Similarly, the encoding function of Node 2 at the zth channel use when the channel is active 
can be defined as: 

X 2 ,i = hA Y t\ W 2 , M 2 , M r ) (83) 
With these preparations, we present the following theorem: 
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Theorem 9: The secrecy rate region of the channel in Figure [7] includes the secrecy capacity 
region of the two-way relay channel in Figure [3l 

Proof: Consider the model in Figure [3] Suppose during a MAC mode, a genie reveals 
X\ + X 2 + N to Node 1 and Node 2. We also add a public noiseless link that takes inputs from 
Node 1 and provides outputs to Node 2 and the relay. We make M r accessible to Node 1 and 
use the public noiseless link to deliver M r to Node 2 and the relay. This side information does 
not increase the knowledge of the relay and hence will not decrease the secrecy capacity region 
of the channel. 

During a broadcast mode, a genie reveals the link noise level N 2 to Node 2. Similarly, the 
link noise N\ is revealed to Node 1. This side information will not decrease the secrecy capacity 
region of the channel either. 

With the side information provided to the nodes, the links from the relay to Node 1, 2 can be 
removed. This is because 

1) Node 1 and Node 2 have the signal received by the relay X\ + X 2 + N. 

2) Node 1 sends M r via the public noiseless forward link. With M r available at Node 2, it 
can compute the signal transmitted by the relay node. Due to the same reason, Node 1 
knows the signal transmitted by the relay node as well. 

3) With noise N 2 available at Node 2, Node 2 can compute the signal it received from the 
relay. For similar reasons, Node 1 can compute the signal it received from the relay as 
well. 

Since Ni,N 2 ,N are independent, Ni and N 2 can be incorporated as the local randomness at 
Node 1 and Node 2 respectively. 

After removing the links from the relay to Node 1, 2, the channel indeed becomes that which 
is described by Figure Ul where Node 3 corresponds to the relay node whose output broadcast 
link to Node 1,2 is removed. Since, every step we took during this transformation could only 
expand the secrecy capacity region, we have proved the theorem. ■ 

To derive an outer bound for the secrecy capacity of the channel in Figure Ul we first consider 
the case when the channel is active regardless of whether the two-way relay channel is in MAC 
mode or broadcast mode. We recognize that in this case, the channel becomes a special case 
of the two-way wiretap channel defined in Section HB Utilizing this connection leads to the 
following corollary: 
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Corollary 2: The secrecy capacity region of the channel in Figure [7J is outer bounded by 

Ri + R 2 < min [C (A) , C (P 2 ) } (84) 
Pi > 0, R 2 > (85) 

where Pj is the average power constraint of Node i. 

Proof: The channel in Figure [7J is a special case of the channel defined in (OQ), where 

Y,Y f ,Z,X,X f (86) 

correspond to 

{X 1 + N, M r }, X 2 + N, {X 1 + X 2 + N, M r }, {X u M r }, X 2 (87) 

respectively, and Pr(Y, Yf, Z\X, Xf) becomes Pr(iV). 

Therefore the corollary follows as a direct consequence of Theorem \5\ with r] = p = 1, 
h 1 = h 2 = 1, cr 2 = 0. ■ 

Note that to apply Corollary [2] to the half-duplex two-way relay channel, we need to take 
into account the channel uses when the channel in Figure [7J is inactive during the channel uses 
when the original two-way relay channel is in the broadcast mode. Hence, the outer bound in 
Corollary [2] becomes the following region A: 

Ri + R 2 < a min {C (A/a) ,C(P 2 /a)} (88) 
Ri > 0, R 2 > (89) 

which reflects the number of channel uses during which some nodes are inactive. 
Define region B as 

< Ri < (1 - a)C{P r /{\ - a)) (90) 
< R 2 < (1 - a)C(hP r /(l - a)) (91) 

Then we have the following theorem: 

Theorem 10: An outer bound for the secrecy capacity of two-way relay channel is given by 

U < Q <i{AnB} (92) 
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Proof: Region A follows by applying Corollary [2] and taking into account the fact that the 
channel is inactive when the original two-way relay channel is in broadcast mode as described 
above. 

Region B follows from removing the secrecy constraint and applying the cut-set bound in 
[10, Theorem 15.10.1]. To derive (19TI) . we consider the cut where the set T includes the relay 
node and Node 2. From the cut-set bound, we get: 

H(W 2 ) < mI(X 2 ,X r ; Y^Xx) + (m + n)e (93) 

e > and lim m+n ^ 00 e = 0. 
Therefore, we get 

777 

H(W 2 ) < — I(X 2 , X r ; Y^Xi) + e (94) 



m + n m + n 

It is easy to see that for the Gaussian two-way relay channel, I(X 2 , X r ;Yi\Xx) is maximized 

when Xi,X 2 ,X r takes an independent Gaussian distribution with maximum possible variance. 

Let m + n — > oo, and use the fact that lim m+?woo = 1 — a, we obtain (l9TT) by evaluating 

(|94|) for this distribution. 

Equation (l90l) is derived similarly due to the symmetry of the channel model. 

Hence we proved the theorem. ■ 

Remark 10: When P r — > oo, and h ^ 0, then the region is maximized when a — > 1. The 

outer bound becomes: 

i?i + i? 2 < min [C (A) , C (P 2 ) } (95) 
Ri > 0, R 2 > (96) 

□ 

A. Comparison with Achievable Rates 

In this section, we compare the outer bound with the achievable secrecy rate region. 
We begin by restating an achievable rate for Ri from [17]. The rate region then follows from 
time sharing. 

Theorem 11: [17, Theorem 1] The following secrecy rate of Ri is achievable for the model 
in Figure [3] 



< R\ < max a 

0<P^<Pi/o,0<a<l 



{l+al) \{l + P 2 ), 



(97) 
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where o\ is the variance of the Gaussian quantization noise determined by: 

ac(%±±\ =(l-a)C(P r ) (98) 

P2 was defined in (1251) . P r was defined in (1261) . 

Remark 11: The achievable scheme above uses compress-and-forward. And Node 1 and 2 
ignore their received signals when computing the transmitted signals. The proof can be found 
in [17]. 

Remark 12: For any fixed a such that < a < 1, if the power of the relay P r — > 00, then 
a\ — > 0, the achievable rate converges to 

a (C(Px) - (99) 

Equation (|99b is a monotonic increasing function of cc. Hence, as long as a < 1, we can always 
increase a and increase the achievable secrecy rate. Therefore, when P r — > 00, the optimal time 
sharing factor a — > 1. The achievable rate then converges to 

C(P 1 )-C( T ^ p -) (100) 

The secrecy rate region is obtained with time sharing and it converges to 

Ri + R2 < C(Px) - C(— (101) 

Pi>0,P 2 >0 (102) 

□ 

Utilizing this result, we have the following corollary: 

Corollary 3: When P r — > 00, the gap between the outer bound and the achievable rate is 
bounded by 0.5 bit per channel use. 
To prove this corollary, we need the following lemma: 

Lemma 1: Define the following functions: 

H*,y) = ^( {1 l: )( \ +y) ) (>03) 

2 y 1 + x + y J 
g(x,y)=mm{C(x),C(y)} (104) 

Let h(x, y) = g(x, y) - f(x, y). Then < h(x, y) < 0.5. 
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Eavesdropper 



Fig. 8. A wiretap channel with noisy feedback 



Proof: Without loss of generality x < y. For x > y, simply exchange x and y. h(x,y) is 
given by 

h(x,y) 4 1 ° g2 ( 1 l + ^ ) (105) 

<ilog 2 (l + l) = 0.5 (107) 

Clearly h(x,y) > 0. Hence < h(x,y) < 0.5. ■ 
Corollary |3] can then be proved by letting x = P\,y = P 2 . The upper bound on the sum rate and 
the achievable sum secrecy rate then become g(x, y) and f(x, y) when P r — »■ oo. Using Lemma 
CD we prove the gap between the upper bound and lower bound of the sum secrecy rate is less 
than 0.5 bit per channel use. Since the achievable region and the outer bound are only different 
on the bounds for the sum rate, this proves the gap between the inner bound and outer bound 
of the secrecy capacity region is also less than 0.5 bit per channel use when P r — > oo. Hence 
we have proved Corollary [3l 

V. Alternative Proofs of Corollary [Hand Corollary [2] 

Corollary \T\ and Corollary [2] can also be proved by using results on the wiretap channel with 
noisy feedback [28]. In this section we provide these proofs for completeness. 

A. A Wiretap channel with noisy feedback 

The channel model is shown in Figured Node 1 sends a message W to Node 2, which must 
be kept secret from the eavesdropper. The channel is described by 

VT{Y,Z,Y s \X,X f )=VT{Y,Z\X)YT{Y f \X f ) (108) 
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Within each channel use, Node 1 and Node 2 take turns to transmit. This implies that, Figure [8] 
is not a special case of the two-way wiretap channel in Figure [Q Without loss of generality, we 
assume Node 2 transmits first. 

At the ifh channel use, the encoding function of Node 1 is defined as: 

X i = f i {Y),W,M 1 ) (109) 

Note that since Node 2 transmits first, Node 1 has an extra sample of Yf to use when computing 
its transmitted signals. Therefore in (11091) . Yi is used instead of Yj~ . 
The encoding function of Node 2 is defined as 

X Li = gi (Y l -\M 2 ) (110) 

fi,gi are deterministic functions. 

Let n be the total number of channel uses. The destination must decode W reliably from 
Xj,Y n ,M 2 . Hence from Fano's inequality, we have 

H{W\X], Y n , M 2 ) < ne 4 (1 11) 

where £ 4 > and Hindoo e A = 0. 

The message W must be kept secret from the eavesdropper. Hence 

I(W;Z n )<ne 5 (112) 

where e 5 > and Hindoo e 5 = 0. 

Theorem 12: The secrecy capacity of the channel model in Figure [8] is upper bounded by 

R e < max mm{I(X;Y),I(X;Y\Z) + I(X f ;Y f )} (113) 

Pr {X^Xf ) 

Proof: The proof is provided in Appendix [0 ■ 
Corollary 4: If X — Y — Z is a Markov chain, the secrecy capacity of the channel model in 
in Figure [8] is given by 

max mm{I(X:Y),I(X:Y)-I(X:Z)+I(X f -Yf)} (114) 

Pr(X,X f ) 
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Fig. 9. The degraded model 



Proof: Equation (II 141) is achievable because of [8, Theorem 3.1]. In details, the rate (II 141) 
can be obtained by letting V f = X, Y f = Y, Z f = Z, U f = <j), V b = X f , Y h = Y f , Z h = <p in [8, 
Theorem 3.1]. 

When X - Y - Z is a Markov chain, we notice I(X; Y\Z) = I(X; Y) - I(X; Z). Hence the 
achievable (|1 14|) matches the upper bound in (II 131) . ■ 

Remark 13: When the backward channel Pr(Yf\Xf) is a rate limited noiseless link, whose 
rate is Rf, then I(Xf] Yf) = H(Xf) = Rf. Then using Corollary HI we obtain the result in [5]. 

□ 

B. Alternative Proof of Corollary [7] 

Theorem 13: For the degraded case considered in Section IIII-D21 Ri is upper bounded by 

mm{C(P),C(^P r )} (115) 
hi 

where P r = P r + ^. 

Remark 14: Since hi < 1, it can be verified that the upper bound in (II 151) is looser than (|81T) . 
However, this bound is sufficient to prove the 0.5 bit gap result. 
Proof: 

We begin by redrawing the channel model in Figure [9] where N' 2 is a zero mean Gaussian 
random variable with variance 1 — hi. 

The first term C(P) follows by removing the eavesdropper and applying the upper bound for 
Gaussian two-way channel from [2]. 

In order to obtain the second term in (II 151) . we convert the model in Figure [9] to the model in 
Figure [TOl In this new model, N' 2 is removed, and the power constraint of Node 2 is increased 
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Eavesdropper 



Fig. 10. The model with cooperative jamming 




Eavesdropper 



Fig. 11. The model with feedback 

from P r to P r = P r + ^t^ 1 - Since Node 2 can always use this additional power to transmit noise 
which is statistically equivalent to N 2 , the secrecy capacity of Figure \\0\ is greater or equal to 
the secrecy capacity of Figure [H 

We next prove that the secrecy capacity of the model in Figure \TT\ must be greater or equal 
to the secrecy capacity of the channel model in Figure [TOl Figure \TT\ is a special case of the 
wiretap channel with noisy feedback. For this model, the encoding functions used by Node 1 
and 2 at the 2 th channel use are denoted by fa and g ri and are defined in (11091 ) and (II 101) . The 
power constraint of Node 2 is j^P r - Node 1 is not constrained in transmission power. 

We prove that any signaling scheme in Figure [10] can be simulated by Figure QT] This means 
for any set of encoding functions of Node 1 and 2, denoted by {/j} {g,} respectively in Figure ITOl 
we can find encoding functions {/«}, for Figure [CD such that given the same noise sequence 
Nf = Ni and the same local randomness Mj,j = 1,2, the message can be reliably received by 
Node 2 at the same secrecy rate. This can be shown as follows: 

We choose fi, the encoding function used by Node 1 in Figure ITTI as: 

X i = Y f)i + f i (W,M 1 ) (116) 
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<7i, the encoding function used by Node 2 in Figured!] is chosen as: 



hi 



i-1 



Then, as shown below, if 
stands for fj(M 1 , W),j = 1, i - 1. 
We begin with: 



(117) 

%Xf-\ then X u = x /t X r,i- The notation f'^Mi, W) 



X 



hi 



g^X*" -X)~\M 2 



Using (11161) . we get: 

X f,i 



h 

h 



'^~9i [Yf 1 + r 1 (W, MO - Xf\ M 2 



{X}- 1 + N)~ l + r l (W, My) - X)~\ M 2 



Since N}' 1 = Nf 1 , (ED equals: 



'■?9i (Nt 1 + f i - 1 (W,M 1 ),M 2 



Since X^ 1 = /^(W, Mi), fl22> equals 



7? 
hi 

hi 



Y 



Hence, when n channel uses are involved, we have X" = xfj^X? 



Using this result, from (II 161) we have 

X i = Y f j + f i (W,M 1 ) 

= X f)i + N fti + f i (W,M 1 ] 



^X^ + N^ + UiW^Mi] 
hi 



-1—X r i + N\i + Xi — Zi 



(118) 

(119) 
(120) 
(121) 

(122) 

(123) 
(124) 
(125) 



(126) 
(127) 

(128) 
(129) 
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Therefore the signals received by the eavesdropper in Figure [TT] is the same signals received by 
the eavesdropper in Figure [TO] 

The destination in Figure [TT] knows Xj ti . Therefore, it can compute fa (W, Mi) + Nfj from 
Xi-Xfj. On the other hand, (W, Mx)+Nf ti = (W, M 1 ) + Ni >i is exactly the signal received 
by Node 2 in Figure [10] at the zth channel use. This fact, along with the fact that X r>i = Xf ti , 
shows that the destination in Figure [TT] can compute any signal known by the destination in 
Figure [lJJ This means that, if W can be reliably received in Figure [TO] it can also be reliably 
received in Figure [TT] at the same rate. 

Hence we have proved that an upper bound for the secrecy capacity of Figure [TT] is an upper 
bound for Figure [TO] From Corollary [4] it follows that the secrecy capacity of Figure [TT] is 
C(j^P r ). Applying it to Figure [TO] we obtained the second term in the upper bound (II 151) . 
Hence we have the theorem. ■ 
The 0.5 bit gap then follows from Lemma [lj In our case, the achievable rate can be expressed 
as f(x,y) where x — P,y — j^P r - The upper bound can be expressed as h(x,y). Hence from 
Lemma [Q we proved the gap between the achievable rate (|80l) and the upper bound (11151) can 
not exceed 0.5 bits per channel use. 

C. Alternative Proof of Corollary [2] 

Consider the channel in Figure [l2l It is the same channel as Figure [UJ except that the power 
constraint of Node 2 is changed to P 2 . Again it is a a special case of the wiretap channel with 
noisy feedback. For this model, the encoding functions used by Node 1 and 2 at the ith channel 
use are denoted by f and g; t and are defined in (11091) and (II 101) . W is replaced by W\. 

Theorem 14: The secrecy rate for the channel in Figure [12l where each node takes turn to 
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transmit and Node 2 transmits first, is greater than or equal to the maximal achievable individual 
rate Ri of the channel in Figure [7J 

Proof: We prove the theorem by showing any coding scheme of Figure |7J can be simulated 
by the channel in Figure d2l This means for any set of encoding functions of node j, {fj,i}, 
j = 1,2, in Figure |7J we can find encoding functions for Node 1 and Node 2 in Figure [[2l 
such that at the same secrecy rate the message W\ can be reliably received by Node 2. For the 
encoding functions defined in (l82l) and (1831) . we choose the encoding functions for Figure d2l 
are chosen as: 

Xi = h,i (V;-\ Wt, M u M r ) + Y u (130) 

X u = h,i (X*- 1 - X}~\ W 2 , M 2 , M r ) (131) 

M r is obtained by letting Node 1 transmitting it over the noiseless public forward link. Then, 
with these encoding functions, the eavesdropper receives exactly the same signal as the signal 
received by the eavesdropper in Figure |7J if these two models experience the same noise sequence 
Nf = N and the same local randomness Mj,j = 1, 2, M r . This can be proved as follows: 

We begin by assuming Xy 1 = X%~ , and prove Xfj = X 2 ,i and Xi — Yfj = Xi^. 

To prove Xf^ = X 2 ,i, we compare (11311) with (l83l) and find that we need to prove X 1 " 1 — 
Xf 1 = Yt 1 - We begin with 

X l ~ x - X}- 1 = X^ 1 - Y}- 1 + Nf 1 (132) 

From (11301) . we have 

_ yi-1 (133 ) 

=ft 1 (Y}-\W 1 ,M 1 ,M r ) (134) 
Since we assume X^ 1 = X l 2 ~ x and Ny 1 = N 1 ^ 1 , we get 

yy 1 = xy 1 + Ny 1 = xy 1 + n^ 1 = Yy 1 (135) 

Hence (11341) equals 

ft 1 (Yy\ Wx, Mi, M r ) = Xy 1 (136) 
The equality in (fT36l) follows from <[82]>. Hence X^ 1 - Xy 1 = X^ 1 and (fT32l) equals: 

x^ 1 - xy 1 = xy 1 + ivr 1 = xy 1 + iv^ 1 = Yy 1 (137) 
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Hence from (11371) we have shown 

X u = X 2ii (138) 
From (11351) . by comparing (11301) with (f8~2l) . we get 

X t - Y u = X hi (139) 

From (fT38l) and (fT39l) . we get 

X t = X lti + Y u = X X4 + X u + N u = X lti + X 2 , + Nt (140) 

Until this point, we have shown that the signals received by the eavesdroppers in the two models 
in Figure [12] and Figure [7J are identical. 
From (11391 ). we get 

Y 2>i = X hi + N, = X t - Y u + N l =X i - Y u + N f)i = X t - X f)i (141) 

Hence Node 2 in Figure [[2] can recover the signals received by Node 2 in Figure U\ On the other 
hand, since Xf ti = X 2 i , Node 2 in Figure [[2] can also recover the signals transmitted by Node 
2 in Figure U\ This means if a message can be reliably decoded at a certain rate by Node 2 in 
Figure Ul it can also be decoded reliably by Node 2 in Figure [7] at the same rate. 

Hence we have proved the theorem. ■ 

The secrecy capacity of the model in Figure [12] is given by Corollary SI From Corollary HI 
we know Ri < C(p2). We next invoke the same technique we used in the proof of Theorem |2] 
in Appendix |B] to show C(p2) is also an upper bound on the sum rate. We prove this statement 
by showing if R\ = r±, R 2 = r 2 is achievable, then R\ = n + r 2 is also achievable. 

Let us construct a message set {W a } which has the same cardinality of the message set {H^}- 
Let part of the secret message be transmitted via W a . The remaining part of the secret message 
be transmitted via W\. The role of W 2 is to be the secret key. Let W 2 be taken from the set 
{W 2 } according to a uniform distribution. W 2 is independent from W a and W\. 

Let © be the modulus addition defined over {1, ... ||W 2 ||}. Node 1, after decoding W 2 , transmits 
W 2 © W a over the public channel. Since the public channel is noiseless with continuous input, it 
can transmit W 2 © W a with less than n channel uses. Because Node 2 knows W 2 , it can recover 
W a from W 2 © W a if W 2 = W 2 . 
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The signal available to the eavesdropper now becomes the output of the wiretap channel X n , 
and the output of the public link W a © W 2 . Then, by the same derivation in (|199I) - (I215I) . by 
replacing Z n with X n , we have: 

H(w u W a \X n ,W a ®W 2 ) (142) 

>H(W u W a )-ne (143) 

where e > 0. Hindoo e = 0. Hence the rate of W±,W a is the secrecy rate R±. Since W a is 
chosen from the message set {W a } according to a uniform distribution, we have R\ = r± + r 2 . 

Due to the symmetry of the channel model, we can prove that R 2 < C(P 1 ) and R\ + R 2 < 
C(P 1 ) in the same fashion. 

This completes the proof. 

VI. Conclusion 

In this work, we have investigated the merit of using the signals received by the source node, 
i.e., the feedback, for encoder design on achieving a larger secrecy rate region. In order to 
answer this question, we studied two models: the Gaussian two-way wiretap channel, and the 
Gaussian half-duplex two-way relay channel with an untrusted relay. For each model, we derived 
a computable outer bound for the secrecy capacity region. For the first model, by measuring the 
gap between the outer bound and the achievable rate region, we find the loss in secrecy rate due 
to ignoring the feedback signals can be unbounded. Hence the use of feedback can be highly 
beneficial in this model. For the second model, we find the feedback can be safely ignored if 
the power of the relay is abundant. In particular, the gap between the achievable rate region and 
the outer bound is bounded by 0.5 bit per channel use when the power of the relay goes to oo. 
It is worth mentioning that the achievable rate region in this case is attained via a time sharing 
cooperative jamming scheme, which, with its simplicity and near optimum performance, is a 
viable alternative to an encoding scheme that utilizes feedback signals. 

Appendix A 
Proof of Theorem CD 

Let e = Si + £3, where e 1 was defined in ©, and e 3 was defined in ®. To simplify the 
notation, we use M' 2 to denote {M 2 , W 2 }. Then we have: 

H(W l )-ne (144) 
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<#(W^|Z n ) -H (w 1 \Z n ,X],Y n ,M' 2 ) (145) 

=1 (W^M^X^Y^Z 71 ) (146) 

=1 (w l ;X 1 }\Z n l Y n } M^ + I (Wr, M' 2 ,Y n \Z n ) (147) 

=1 {Wv, M' 2) Y n \Z n ) (148) 

^/(i^M^y^M^y"!^) (149) 

=/ (W 1} Mi, F/; Ma, 1™, Z n ) - / (Wi, Mi, F/; Z n ) (150) 

where in (11451) follows from © and ([8]). Note that since, in this proof, we are only bounding 
the rate of Wi, we omit W 2 from the condition term of ©. (11481) is based on the fact that XJ 
is a deterministic function of Y n ~ l and M 2 , as shown in ©. 
Then we rewrite the first term in (11501) as: 

I {w^M^Yf-M'^Y* 1 ^ 11 ) (151) 

=/ (wi, Mi, y n |z n , Mg, r- 1 , z*- 1 ) + 1 (Wi, Mi, f/ ; Y n ~\ z n , m' 2 ) (152) 

For the first term in (11521) . we have: 

i (wi, Mi, r/ ; r n |z n , m 2 , r- 1 , z"- 1 ) (153) 

=/ (Wi, Mi, r/; Y n \X fttl , Z n , M 2 , F n_1 , Z"" 1 ) (154) 

</i (Y n |Z n , X />n ) - h (Y n \X f , n , M 2 , Y n ~\ Z n , Wi, Mi, F/) (155) 

=/i (y„|Z w X f>n ) - h (Y n \X f , n , X n , M 2 , Y n ~\ Z n , W 1 , Mi, Y?) (156) 

=/i (y n |Z n , X/,„) - h (Y n \X f , n , X n , Z n ) (157) 

=I(X n ,Y n \Z n ,X Ln ) (158) 

In (11541) , we use the fact that X^ n is a deterministic function of {M 2 , Y n ~ 1 }, as shown by ©. 
In (11561) . we use the fact that X n is a deterministic function of {Wi, Mi, YJ 1-1 }, as shown by 
©. In (11571) . we use the fact that 

Y n - {X f>n , X n , Z n } - {M 2 , Y n ~\ Z n ~\ W h M u Yf} (159) 

is a Markov chain, due to © and the channel being memoryless and the fact that encoding 
functions are causal. In particular, (Q]) allows us to remove Y^ n from the condition term. Applying 
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this result, we find that (11501) is upper bounded by 

I (X n , Y n \Z n , X f , n ) + l(W x , M x , Y?\ Y n ~\ M' 2 \Z n ) (160) 

The second term in (11601) can be rewritten as: 

/(Wi,Mi,Y/;Y n -\M2|Z re ) (161) 

=/ (W x , Mi , r/- 1 ; Y n " 1 , M^ I Z n ) + / (y />n ; Y n ~ 1 , M' 2 \ W x , M x , Y/" 1 , Z n ) ( 1 62) 

The second term in (11621) can be upper bounded as: 

/ (y /jn ; Y"" 1 , Mg I Wi , Mi, Y/- 1 , Z») (163) 

=/ (y /)n ; Y"~\ M^|X n , V^i, Mi, Y?-\ Z n ) (164) 

=/i (y /)n |x n , w x , Mi, y;- 1 , z n ) - & (Y/,„|x n , wi, m 1; y;-\ z re , y re -\ m£) (165) 

</i (Y/,„|X„, Z n ) - ft (Y f ,„|X„, W x , Mi, Y/- 1 , Z n , Y 1 " 1 , M£) (166) 



=ft (Y/,n|^n, ^n) " h \Y f , n \X f ^ X m Z n , W x , M x , Y f n ~\ Z n ~\ Y n ~\ M' 2 ) (167) 
=h (Yf in \X n , Z n ) - h (Yf jn ,\Xf jn , X n , Z n ) (168) 
=I(X f , n ;Y ftn \X n ,Z n ) (169) 

In (11641 ), we use the fact that X n is a deterministic function of {W x , M x , Y™ -1 }, as shown by 
©. In (11671) . we use the fact that Xf >n is a deterministic function of M 2 , Y n_1 , as shown by 
©. In (11681) . we use the fact that 

Y/,n - {x f , n , x n , z n } - {w x , Mi, y;- 1 , z"~\ y"-\ m' 2 ] (no) 

is a Markov chain. This is because the encoding functions are causal and the channel is mem- 
ory less. 

Applying this result, we find that that (11601) is now upper bounded by 

I (X n , Y n \Z nj X f>n ) + I(X f>n ; Y f , n \X n , Z n ) + / (w x , M x , Y/" 1 ; Y n ~\ M' 2 \Z n ) (171) 
The last term in (11711) can be rewritten as 

I (Wi, Mi, Yp- 1 ; Y n ~\ M' 2 \Z n ~ l ) +l(W x , M x , Y/" 1 ; Z n \Y n ~\ M' 2 , Z n ~ l ) 

- 1 (w x , Mi, y;- 1 ; z n \z n ~ l ) {in) 
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The second term and the last term in (11721) can be upper bounded together: 

I (Wt, M x , Yf' 1 ; Z n \M' 2 , Y n ~\ Z n ~ l ) - I (W u Mi, Yf' 1 ; Z n \Z n ~ l ) (173) 
= - / (Z n - M' 2 , Y n - l \Z n ~ l ) - h (z n \W x , Mi, Yf~\ M' 2 , Y n ~\ Z n ~ l ) 

+ h (z n \Z n -\ Wi, Mi, y/- 1 ) (174) 
<-h (z n \Wi, Mi, Yf~\ M' 2 , Y n ~\ Z n ~ l ) + h [z n \Z n ~\ Wi, Mi, Yf- 1 ) (175) 
= -h (z n \X n , X Ln , W u Mi, Y?- 1 , M' 2 , Y n ~\ Z n ~ l ) + h (z n \X n , Z n ~\ W x , M x , Y f 



•— i 
(176) 

<-h (Z n \X n , X f>n , Wi, Mi, Yf' 1 , M 2 , Y n ~\ Z n - X ) + h (Z n \X n ) (177) 
= -h (Z n \X n , X f , n ) + h (Z n \X n ) (178) 
=I(X f>n ,Z n \X n ) (179) 

In (11761) . we use the fact that X n is a deterministic function of {Wi, Mi, Yf' 1 }, and Xf >n is a 
deterministic function of {M' 2 ,Y n ~ 1 }. In ( 11781 ), we use the fact that 

Z n - {X n , X f>n } - {Wi, Mi, Yf' 1 , M 2 , Y n ~\ Z^ 1 } (180) 

is a Markov chain. This is due to the fact that the channel is memoryless and the encoding 
functions © and © are causal. 

Applying this result to (11721) . we find that that (11711) is now upper bounded by: 

I (X n , Y n \X Ln , Z n ) + I(X Ln , Y Ln , Z n \X n ) +l(Wi,Mi, Yf' 1 - Y n ~\ M' 2 \Z n ^) (181) 

Hence we have shown that 



H{Wi) -ne<I (Wi, M x , Yf; Y n , M' 2 \Z n ) 
<I{X n ,Y n \X f 

,ni Z n ) + I {X Ln , Y f ,ni Z n 

\Xn) 

+ / (Wi, Mi, Yf- 1 ; Y n -\ M' 2 \Z n - v \ (182) 



Applying this result repeatedly for n — 1, n — 2, 1, we have 



-H(Wi) - e (183) 

n 

1 n 

<- Yi\X fti , Zi) + I(X U ; Y u , Zi\Xi)) (184) 

n i=i 
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Fig. 13. Two-way wiretap channel with a public noiseless forward link 

Define Q as a random variable that is uniformly distributed over {1, 2,...,n}. Define X = 
X Q , Y = Y q ,Z = Z q , X f = X M , Y f = Y f)Q . Then the right hand side of CEM equals: 

I{X; Y\Z, X f , Q) + I(X f ; Y f , Z\X, Q) (185) 
<I{X;Y\Z,X f ) + I{X f ;Y f ,Z\X) (186) 

where we use the fact that Y — {Z, Xf, X} — Q is a Markov chain and {Yf, Z} — {X, X f } — Q 
is a Markov chain. Applying this result in (11841) and let n — > oo, we obtained the upper bound 
in the theorem. 

Appendix B 
Proof of Theorem [2] 

Equation (l47l) follows from removing the eavesdropper and applying the bounds of two-way 
channel from [1]. Equation (1481) can be derived similarly thanks to the symmetry of the channel 
model. 

We next derive (|49| ). We focus on the first term inside the minimum in <|49l) . The second term 
can be derived similarly thanks to the symmetry of the channel model. 

First we add a public noiseless broadcast channel to the channel in Figured! The new channel 
model is shown in Figure [T3l The broadcast channel takes the input from Node 1 . Its outputs 
are received by Node 2 and the eavesdropper. Since the channel is noiseless, the outputs equal 
the input, and is denoted by Xq- Xq is continuous. The introduction of the public noiseless 
broadcast channel certainly does not decrease the secrecy capacity region. Hence, to upper bound 
the secrecy capacity region of the original channel, we can consider this new model instead. We 
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next apply Theorem Q] to this channel, which says R± is bounded by 

/(X, X c ; Y, X C \Z, X c , X f ) + I(X f] Y f , Z, X C \X, X c ) (187) 
The first term in (11871) is upper bounded by: 

I(X,Xc;Y,Xc\Z,X c ,X f ) =1 (X;Y\Z,X c ,X f ) (188) 

=h (Y\Z, X c , X f ) - h (Y\Z, X, X c , X f ) (189) 

<h (Y\Z, X f ) - h (Y\Z, X, X c , X f ) (190) 

=h(Y\Z,Xf)-h(Y\Z,X,X f ) (191) 

=I(X;Y\Z,X f ) (192) 

In ( 11911) we use the fact that Y - {Z, X, X f } - X c is a Markov chain. 
The second term is (11871) is upper bounded by: 

l[Xf,Yf,Z,Xc\X,X c ) (193) 

=l{X f ,Yf,Z\X,Xc) (194) 

<h (Y f , Z\X) - h (Y f , Z\X, X f , X c ) (195) 

=h(Y f ,Z\X) -h(Yf,Z\X,X f ) (196) 

=I(Xf,Y f ,Z\X) (197) 

In (11961) we use the fact that [Y f , Z} - {X, X f } - X c is a Markov chain. 
Hence (11871) is upper bounded by 

I(X; Y\Z, X f ) + I(X f ; Y f , Z\X) (198) 

This means introducing a public noiseless forward channel brings no change in the expression 
of the upper bound of R\ . 

We next prove (11981) is also an upper bound on R\ + R 2 . This is done by showing if Ri = 
ri, R 2 = r 2 is achievable, then R± = r\ + r 2 is also achievable. 

Construct a message set {W a } which has the same cardinality of the message set {W^}- Let 
part of the secret message be transmitted via W a . The remaining part of the secret message is 
transmitted via W\. The role of W 2 is to serve as a secret key. Let W 2 be taken from the set 
{W 2 } according to a uniform distribution. W 2 is independent from W a and W\. 



Let © be the modulus addition defined over {1, ... HW2II}, where || W2II is the cardinality of 
the set {W2}. Recall that W 2 denote the result obtained by Node 1 when it tries to decode W 2 . 
We let Node 1 transmit W 2 © W a over the public channel. Since the public channel is noiseless 
with continuous input, it can transmit W 2 © W a with a single channel use. Because Node 2 
knows W 2 , it can recover W a from W 2 © W a when W 2 = W 2 . 

The signal available to the eavesdropper now becomes the output of the wiretap channel 
Z n , and the output of the public link, which is W a © W 2 . Conditioned on these signals, the 



equivocation of Wt, W a can be computed as: 

H(w 1 ,W a \Z n ,W a ®W 2 ) (199) 

>H(w 1 ,W a \Z n ,W a ®W 2 ,W a ®W 2 ) (200) 

=H (w t , W a , W a © W 2 \Z n , W a ®W 2 )-H (W a © W 2 \Z n , W a © W 2 ) (201) 
=H (Wt, W a \Z n , W a ®W 2 )+H (W a © W 2 \W U W a , Z n , W a © W 2 ) 

- H (W a © W 2 1 Z n , W a © W 2 ) (202) 

>H [Wt, W a \Z n , W a ®W 2 )-H (W a © W 2 \Z n , W a © W 2 ) (203) 

>H (W u W a \Z n , W a ®W 2 )-H (W a © W 2 \ W a , Z" , W a © W 2 ) (204) 

=H (Wx, W a \Z n , W a ®W 2 )-H (W 2 \W a , Z n , W 2 ) (205) 

>H {Wt, W a \Z n , W a ®W 2 )-H (W 2 \W 2 ) (206) 

>H{Wt,Wa\Z n ,W a ® W 2 ) -ne (207) 

In (|207l) we use the fact that W 2 can be reliably decoded by Node 1. Hence (12071) follows from 
Fano's inequality. 

The first term in (12071) can be bounded as follows: 

H(W l ,Wa\Z n ,W a ®W 2 ) (208) 

=H (W a \Z n , W a ®W 2 ) + H (Wt\Z n , W a , W a © W 2 ) (209) 

=H (W a \Z n , W a ®W 2 ) + H (Wt\Z n , W a , W 2 ) (210) 

=H (W a \W a ®W 2 ) + H (Wt\Z n , W a , W 2 ) (211) 

^(WalWa^W^ + HiW^Z 11 ^^ (212) 
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=H(W a ) + H(W 1 \Z n ,W 2 ) (213) 
>H (W a ) + H (Wt) - ne (214) 
>H(W u W a )-ne (215) 

Equation (121 II) is due to the fact that Z n is independent from W a , W 2 , which leads to: 

I (W a ; Z n \W a ® W 2 ) < I (W a , W a © W 2 ; Z n ) = I (W a , W 2 ; Z n ) = (216) 

Equation (12121) follows from the fact that W a is independent from Z n ,W\,W 2 . Equation (12141) 
follows from the fact that collective secrecy implies one message is secure even if the other 
message is revealed to the eavesdropper [12]. 

The argument above shows the rate of Wi,W a is the secrecy rate R±. Since W a is chosen 
from the message set {W a } according to a uniform distribution, we have R\ = r± + r 2 . 

Therefore R\ + R 2 is upper bounded by (11981) . 

Hence we have proved the theorem. 

Appendix C 
Proof of Theorem [6] 

We prove R x — R\, R 2 = is achievable. The achievability of R\ = 0, R 2 = R* 2 can be 
proved similarly due to the symmetry of the channel model. 
The communication is divided into two phases: 

1) The first phase lasts n channel uses. During it, Node 2 sends a key K to Node 1. At the 
same time, Node 1 performs cooperative jamming by transmitting an i.i.d. Gaussian noise 
sequence with power P. 

2) The second phase lasts n channel uses, during which Node 1 encrypts the confidential 
message W with K, and sends the result back to Node 2. At the same time, Node 2 
performs cooperative jamming by transmitting an i.i.d. Gaussian noise sequence with power 
P r . 

Let a = n/(n + n) be the time sharing factor of the first phase. < a < 1 and a is a constant. 
The following notation is used in the remainder of the proof: x denotes any signal x which is 
related to the second phase. Otherwise, the signal is related to the first phase. With this notation, 
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the signals received by the eavesdropper during the two phases are given by: 

Z n = ^h[x n + Jh~ 2 X] + N% (217) 
Z n = ^fh[x n + \fh~iX] + N§ (218) 

The codebooks used by Node 1 and 2 are denoted by C\ and C 2 respectively and are generated 
in the following way: 

C2 is composed of i.i.d. sequences sampled from the Gaussian distribution J\f(0,P r ). The 
codebook is then randomly binned into several bins. The size of the codebook depends on the 
number of bins needed to represent the key K and the size of the bin necessary to confuse the 
eavesdropper. Specifically, the size of the bin is chosen to be 

2 W #)-^ (219) 

where |_^J denotes the largest integer smaller or equal to x, e > and Hindoo e = 0. 
Let Rk be the rate of the secret key. Then there are 2 nRli bins. R K is given by: 

h 2 P r ' 



< R K = -H(K\C 1 ,C2) < min 
n 



C (P r ) - C 




(220) 



Observe that the key rate is chosen to be smaller than C (P r ) — C ( j^pff ) + to keep the key 
K secret from the eavesdropper. As will be shown later, the key is used to compensate the rate 
loss of the forward channel needed to confuse to eavesdropper. Hence, the rate of the key is 
chosen not to exceed this rate loss, which leads to the term C (^ h ^p P +l ^ in (12201 ) . 

C\ is composed of 2 uRk codebooks. Each codebook is composed of i.i.d. sequences sampled 
from the Gaussian distribution A/"(0,P), and is composed of 2 nC ^ i.i.d. Gaussian sequences. 
The sequences of each codebook are randomly binned into several bins. The size of each bin is 
chosen to be: 

2 \ k a*r+ l ) 1;J (221) 

where e\ > and lim^oo ei = 0. 

During the first phase, Node 2 generates a secret key K according to a uniform distribution 
over {1, 2 nRli } and selects the bin from C 2 according to K. Then it chooses a codeword from 
this bin according to a uniform distribution and transmits it to Node 1. 
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Since Node 1 is transmitting an i.i.d. Gaussian noise sequence during the first phase, the 
channel model in this phase is equivalent to the Gaussian wiretap channel [29], which uses the 
same codebook and encoding scheme as we do here. Reference [29] proves that, by doing so, 
K is kept secret from the eavesdropper and can be reliably decoded by Node 1. That is: 

-I(K;Z n \C 1 ,C2) <£ (222) 
n 

lim E[Pt(K ^ K\C U C 2 )\ = (223) 

71— >00 

where e > 0, lim e = 0. 

n—>oo 

Let K be the estimate of K Node 1 decodes from its received signal. Node 1 computes its 
transmitted signals as follows: It first chooses the codebook according to the key K it decoded 
from the first phase. Then, it chooses the bin from the codebook according to the secret message 
W. Finally, it chooses the transmitted codeword from this bin according to a uniform distribution. 

If K — K, then Node 2 knows the sub-codebook used by Node 1. The sub-codebook is 
composed of i.i.d. Gaussian sequences and its rate is within the AWGN channel capacity between 
Node 1 and Node 2. This observation, along with (12231) . leads to the following fact: 

lim E[Pt(W ^ W\Ci, C 2 )\ = (224) 

We next bound the equivocation 

H (W\Z n ,Z n ,C u C 2 ) (225) 

It is understood that Ci,C 2 is always on the condition term. Hence, we omit it in the sequel to 
simplify the notation and reinstate it only when necessary. 
The equivocation rate is then bounded as follows: 



H (W\Z n ,Z n ) 

=H (X n , W\Z n , Z n ) - H (x n \W, Z n , Z n ) (226) 

>H (X n , W\Z n , Z n ) - ne (227) 

=H (w\Z n , Z n , X") + H (x n \Z n , Z") - ne (228) 

=H (x n \Z n ,Z n ) -ne (229) 

=H (X n \Z n , Z n ) - H (X n ) + H (X n ) - fie (230) 
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-H (X n ) - I [X n - Z n , Z n ) - ne 

-H (x fl ) - I (X n - Z n ) - I (X n - Z n \Z n ) - ne 



(231) 
(232) 



Here (12271) follows from the fact that given W, the number of possible X n equals the cardinality 



n(C 



-ei) 



of the bin that corresponds to W from all the 2 nRK codebooks, which is 2 ^\ h 2 Pr+1 J x \ Note 
that these candidates of X n form a Gaussian codebook by itself with a rate of C ' 



,haPr+l t 

e±. Since Node 2 is transmitting i.i.d. Gaussian noise, the channel between Node 1 and the 
eavesdropper is an AWGN channel whose capacity is C ( h ^p P +1 )- Therefore, given W, the 
eavesdropper can determine X n from Z n using joint typical decoding. (12271) then follows by 
applying Fano's inequality. 

Equation (12291) follows since W is a deterministic function of X n . 

The third term in (12321) can then be bounded as follows: 



I(X n :Z n \Z n 



=h (z n \z n ^ 


) -h(z n \z n ,x n ) 


(233) 


=h(z n \z™ 


) -h(z n \X] + N2,X n ) 


(234) 


=h {z n \z n \ 


) - h (z n \x n ) 


(235) 


<h(z n \z^ 


) -h(z n \X n ,K\ 


(236) 


=h [z n \z n \ 


)~h{Z n \K) 


(237) 


=h(z n \z™ 


) -h{Z n )-h{Z n \K) + h{Z n ) 


(238) 


=I{Z n -K) 


- I (Z n ; Z n ) 


(239) 


<I(Z n ;K) 


< ne 2 


(240) 



Equation ( 12351 ) is because XJ + iVJ is a sequence of i.i.d. Gaussian noise, which is independent 
from Z n and X n . 

Equation (12371) follows from the fact that Z n - K - X n is a Markov chain. Equation (12401) 
follows from (12221) . 

Substituting (12401) into (12321) . we have 

(241) 
(242) 



H (w\Z n ,Z f 
>H (X H ) — I (X n \ Z n ) - {ne + ne 2 ) 
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The second term in (12421) can be bounded as follows. For this purpose, we reinstate the C±,C 2 
on the condition term: 

l(x n ;Z n \C x ,C 2 ) (243) 
<h (2 n ) - h (2 n \X n , d, C 2 ) (244) 
=h (2 n ) - h (2 n \X n , d,C 2 ) (245) 



--h(2 R ) -h(2 n \X n ) (246) 
-I (X n - Z n \ (247) 
ml (X; Z) (248) 



Equation (12461) follows from the fact that given X n , Z n only depends on the jamming signal and 
channel noise. Therefore, we can drop codebooks Ci,C 2 from the conditioning term. Equation 
(12481) follows from the fact that Node 2 transmits i.i.d. Gaussian noise during the second phase, 
and the code book used by Node 1 is composed of i.i.d. Gaussian sequences. 
Since 

l(X;Z)=c( r^-r) (249) 



h 2 P r + l t 

H (x n \C u C 2 ) = nR K + nC (P) (250) 



we have 

H (W\Z n ,Z n ,C u C 2 ) (251) 
= (nR K + nC (P)) - nC \ -^-^ \ - (ne + ne 2 ) (252) 

>H(W\C 1 ,C2)-(n(e + e 1 )+ne 2 ) (253) 
Therefore < I(W; Z n , Z n \C u C 2 ) < (n(e + ei) + ne 2 ). This, along with (12241) . gives us: 

Um I(W;Z n ,Z n \Ci,C 2 )+E[Pr(W ^ W)|Ci,C 2 ] = (254) 

n,n^oo jt, -)- /J, 

From the linearity of expectation and non-negativity of mutual information and probability, we 
see that there must exists codebooks C\ = C*, C 2 = C 2 such that both terms on the left hand side 
of (12541) go to as n, n — ► oo. This observation, along with that fact that n + n channel uses 
are involved, proves that the secrecy rate pair (Rl,0) is achievable. 
Hence we have proved the theorem. 
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Appendix D 
Proof of Theorem [7] 

Since received signals are not used to compute transmitting signals at Node j, j = 1,2, we 
let a = 1 in Theorem [6] In this case, when P = kP r , R* becomes: 

r > = c{p) - c (j^TT7p) (255) 

^ = c ^- c {^TTJp) (256) 

The sum rate bound given by Theorem \5\ is upper bounded by: 

P \ „ _ „ / kP 

MP + l 

To prove Theorem U\ it is sufficient to show both R\ and R% are within constant gaps of (12571) . 
as we show below: 

c(^ n -)+C((fe 2 + l)*P)-B; (258) 

= c (mFTi) +c((h 2 + i) kP) -c (P) + c y^jr) (259) 

£C (m^t) + c + 1] kp) - c{p) + c fe) (260) 

<c(J^+C((h 2 + l)kP)-C(P) + c(^\ (261) 



(257) 



*,i) + I^(i±fl^) +0 (A, 



^(^)^^( 1 + maX{ ^ +1)fc}P )^fe) 

<C (^-) + i log 2 (max {1, (fc a + 1) k}) + C (264) 

For R* 2 , we have: 

C (t^Vt) + C ((/i 2 + 1) fcP) - (265) 

=C (^) + G ((fe + 1) *P) - C (kP) + C (^^) (266) 

<C (^^y) + C ((h 2 + 1) fcP) - C (kP) + C ^ (267) 
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- C ' 7r) + C ((/l2 + x) fcP) ~~ C ^ kP) + C (ir) (268) 

^(lUllog 2 f l±^±^ l + C7f^ (269) 



2 oz \ 1 + kP J \hx 
[Pl+l log 2 (h 2 + l) + c( (270) 



Hence we have proved the Theorem. 

Appendix E 
Proof of Theorem [8] 

To prove this theorem, we only need show that it is possible to achievable a secrecy rate for 
Node 1 that exceeds the upper bound given by Theorem 0] Consider the case when h\ — hi = 1. 
Then by evaluating (1571) at a 1 = and a 2 — ► oo with p = 77 = 0, we find the secrecy rate R\ is 
bounded by 

min{C(P), C(P r ) + 0.5} (271) 
when Yf is ignored by Node 1. Choose P r and P such that 

C(P r ) + 0.5 < OAC(P) (272) 

For this power configuration, from (12711) . we observe that Ri is upper bounded by OAC(P). 
Let the a in Theorem [6] be 0.5. R{ then becomes: 



0.5C(P) -0.5 



C[-^—)-C{P r ) + C f 



,p. + iy v ' \p 

A sufficient condition for P* = 0.5C(P) is that 



(273) 



c (/rrr) +c (pT^) >c(ft) (274) 



It can be verified that this condition is equivalent to 

p + 1 

A sufficient condition for it to hold is: 



> 1 (275) 
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which means 

VP> P r + 1 (277) 

Choose P r = P 1 / 4 . For sufficiently large P, both (12721) and (12771) can be fulfilled. In this case, 
the achievable rate is 0.5C(P), which is greater than the upper bound OAC(P). The difference 
is 0.1C(P), which is not a bounded function of P. Hence we have proved the theorem. 

Appendix F 
Proof of Theorem [HI 

The upper bound I(X; Y) follows from removing the eavesdropper and applying the upper 
bound for two-way channel from [1]. Hence we only need to prove the second term inside the 
minimum. 

Let e = Si + £5, where £4, £5 were defined in (11111) and (11121) . Then we have: 

H (W) - ne (278) 

<H (W\Z n ) - H (w\Z n , X], Y n , M 2 ) (279) 

=1 (W;M 2l X^Y n \Z n ) (280) 

=1 (W; X]\Z n , Y n , M 2 ) + / (W; M 2 , y n |Z n ) (281) 

=1 (W;M 2 ,Y n \Z n ) (282) 

^/(w^y/jM^y^Z") (283) 

=/ (W, Mi, y/; M 2 , y n , Z n ) - / (w, Mi, y/; Z n ) (284) 

In (12791) we use (11111) and (11121) . In (12821 ) we use the fact that Xf is a deterministic function 
of y™" 1 and M 2 , as shown in (ITTOl) . 
For the first term in (12841) . we have: 

I (W,M u Yp;M 2j Y n ,Z n ) (285) 

=/ (w, Mi, y; ; y n |z n , m 2 , y re -\ z™- 1 ) + / (w, m 1; y; ; z n |M 2 , r-\ z"- 1 ) 



+ /(iy,M 1 ,y / ri ;y n ^ 1 ,Z^ 1 ,M 2 J (286) 
For the first term in (12861) . we have: 

/ (W, Mi, y/; y n |Z n , M 2 , y"" 1 , Z"" 1 ) (287) 
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<h (Y n \Z n ) - h (F n |M 2 , Y n ~\ Z", W, Mi, Y?) (288) 

=h (Y n \Z n ) - h (Y n \X n , M 2 , Y n ~\ Z\ W, Mi, F/) (289) 

=/i(F n |Z n )-M^n|X n ,Z n ) (290) 

=/(X n ;F n |Z n ) (291) 

In (12891 ), we use the fact that X n is a deterministic function of W, Mi, FJ\ In (12901 ), we use the 
fact that Y n - {X n , Z n } - {M 2 , F n ~\ Z n "\ IF, Mi, F/ 1 }, since the channel is memoryless and 
encoding functions are causal. 

Applying this result, we find that (12841 ) is upper bounded by 

/ pT n ; Y n \Z n ) + / (W, Mi, F/; Z n |M 2 , F n_1 , Z^ 1 ) 

+ / (w 7 Mi, yj 1 ; r- 1 , z n -\ m 2 ) - / (w, Mi, yj\ z n ) (292) 



=/ {X n - Y n \Z n ) + / (W, Mi, Yf] Z n \M 2 , Y n ~\ Z^ 1 

+ / (w, Mi, y/; y- 1 , z n -\ M 2 ) - / (w, Mi, y/; z™- 1 



-/^Mi,^;;^!^- 1 ] (293) 

We next bound the second term and the last term in (12931 ) together, as shown below: 

/ (W, Mi, Yf- Z n \M 2 , Y n ~\ Z^ 1 ) - I (W, Mi, F/; Z n |Z n ^) (294) 
=/i (z n |M 2 , F n_1 , Z n ~ x ) - h (z n \W, Mi, 17, M 2 , r" 1 , Z^ 1 ) 

- h (z n \Z n ~ l ) + h (z n |Z™-\ W, Mi, F/) (295) 
= -/(z n ;M 2 ,y™- 1 |Z"- 1 ) 

- (z n |IF, Mi, F/, M 2 , r- 1 , Z™" 1 ) + (z n \Z n ~\ W, Mi, F/) (296) 



< - ft (Z n |IF, Mi, F/, M 2 , Y n ~\ Z n - X ) + (Z n |Z™-\ W, M x , F/j (297) 
= - ft (z n |X n , W, Mi, Yf, M 2 , F"- 1 , Z^ 1 ) + h (z n |X n , Z"" 1 , IF, Mi, Yf) (298) 



= -/i(Z n |X n )+/ i (Z n |X n ) (299) 
=0 (300) 

In (1298k we use the fact that X n is a deterministic function of W, Mi,Yp. In (1299k we use 
the fact that Z n - X n - {W, M u Y f n , M 2 ,Y n '\ Z™" 1 } is a Markov chain and Z n - X n - 
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{Z n ~ 1 ,W,Mi,Yf 1 } is a Markov chain. Both are a consequence of the fact that the channel is 
memoryless and the encoding functions (11091) and (II 101) are causal. 
Applying this result to ( 1293b , we find it is upper bounded by: 

I (X n , Y n \Z n ) + I (W, Mi, Yf~; Y n ~\ Z n ~\ M 2 ) - I (w, M h Yf- Z n ~ l ) (301) 

The second term in (13011) can be combined with the last term in (13011) and expressed as: 

I (w,M 1 ,Yl l ;Y n -\M 2 \Z n ~ 1 ) (302) 



/ 

=/ (W, Mi, Y?- 1 ; Y n ~\ M 2 \Z n ~ 1 ) + I (y />n ; Y n ~\ M 2 \W } M u YJ~ X , Z 71 " 1 ) (303) 
The last term in (13031) can be upper bounded as: 

/ (y />n ; Y n_1 , M 2 \W, Mi, Yf~\ Z^ 1 ) (304) 

<h (Y />n ) - h (Y ln \W t M u Yf~\ Z n ~\ Y n ~\ M 2 ) (305) 

=h (Y) >n ) - h (Y f , n \X f , n7 W, Mi, y/- 1 , Z"" 1 , Y n ~\ M 2 ) (306) 

=/i(y /jn )-/i(y /ift |x /ift ) (307) 

=I(X ftn -Y f>n ) (308) 

In (13061) . we use the fact that Xf, n is a deterministic function of Y n ~ x , M 2 . (13071) follows because 
Y), n - X Ln - {W, Mi, y/-\ Z"- 1 , y™" 1 , M 2 } is a Markov chain. 
Applying this result to ( 13011 ). we find (13011 ) can be upper bounded as: 

/ (X n ; Y n \Z n ) + / (X f , n ; Y f , n ) + / (w, Mi, y?" 1 ; F" 1 , M 2 |Z^ 1 ) (309) 

Hence we have shown 

H(W) -ne<I (W, Mi, Y/; Y n , M 2 \Z n ) 

< I (X n ; Y n \Z n ) + / (X /jn ; Y />n ) + J (w, M 1; Y?" 1 ; Y""\ M 2 \Z n ~ l \ (310) 



Applying this result repeatedly for n — 1, n — 2, 1, we have 



1 1 n 

- e < - E( J ( X - ^1^) + J fe Y u)) (311) 



Let us define Q as a random variable that is uniformly distributed over {1, 2, n}. Further, 

define X = X Q , Y = Y Q , Z = Z Q , X f = X fjQ , Y f = Y f)Q . Then, the right hand side of (13111) 
can be expressed as 

I(X;Y\Z,Q)+I(X f ;Y f \Q) (312) 
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<h (Y\Z) - h (Y\X, Z,Q) + h (17) - h (Y f \X f , Q) (313) 
=h (Y\Z) - h (Y\X, Z) + h (17) - h (Y f \X f ) (314) 
=I(X;Y\Z)+I(X f] Y f ) (315) 

Applying this result in (13031) and letting n — > oo, we obtain the upper bound in the theorem. 
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